Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_update_preflight.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from datetime import UTC, datetime, timedelta
+
+from fastapi.testclient import TestClient
+from pydantic import SecretStr
+
+from modelforge_api.domain.release import PRODUCT_VERSION, TARGET_SCHEMA_REVISION
+from modelforge_api.main import app
+from modelforge_api.settings import Settings, get_settings
+
+ADMIN_TOKEN = "update-preflight-admin-test-token-long-enough"  # noqa: S105 - synthetic test credential
+VIEWER_TOKEN = "mfop_" + "v" * 43
+OPERATOR_TOKEN = "mfop_" + "o" * 43
+
+
+def test_update_preflight_is_read_only_admin_only_and_marks_missing_approval_unknown() -> None:
+    identities = [
+        {
+            "credential_id": role,
+            "subject": role,
+            "role": role,
+            "token_sha256": hashlib.sha256(token.encode()).hexdigest(),
+            "expires_at": (datetime.now(UTC) + timedelta(days=1)).isoformat(),
+        }
+        for role, token in (("viewer", VIEWER_TOKEN), ("operator", OPERATOR_TOKEN))
+    ]
+    settings = Settings(
+        _env_file=None,
+        operator_api_key=SecretStr(ADMIN_TOKEN),
+        operator_identities=SecretStr(json.dumps(identities)),
+    )
+    app.dependency_overrides[get_settings] = lambda: settings
+    client = TestClient(app)
+    try:
+        path = "/api/v1/admin/updates/preflight"
+        assert client.get(path).status_code == 401
+        for token in (VIEWER_TOKEN, OPERATOR_TOKEN):
+            denied = client.get(path, headers={"X-ModelForge-Admin-Token": token})
+            assert denied.status_code == 403
+
+        response = client.get(path, headers={"X-ModelForge-Admin-Token": ADMIN_TOKEN})
+        assert response.status_code == 200
+        payload = response.json()
+
+        assert payload["read_only"] is True
+        assert payload["status"] == "INCOMPLETE"
+        assert payload["current"]["version"] == PRODUCT_VERSION
+        assert payload["current"]["schema_revision"] == TARGET_SCHEMA_REVISION
+        assert payload["approved"]["version"] is None
+        assert payload["approved"]["status"] == "UNKNOWN"
+        assert payload["approved"]["notes"]["status"] == "UNKNOWN"
+        assert payload["approved"]["notes"]["value"] is None
+        assert payload["impact"]["schema"]["status"] == "UNKNOWN"
+        assert payload["impact"]["schema"]["value"] is None
+        assert payload["impact"]["breaking"]["status"] == "UNKNOWN"
+        assert payload["impact"]["breaking"]["value"] is None
+        assert payload["backup"]["required"]["status"] == "UNKNOWN"
+        assert payload["backup"]["required"]["value"] is None
+        assert payload["provenance"]["current"]["status"] == "UNKNOWN"
+        assert payload["provenance"]["approved"]["status"] == "UNKNOWN"
+        assert payload["execution"] == {
+            "available": False,
+            "control": "HUMAN_CONTROLLED",
+        }
+
+        assert client.post(path, headers={"X-ModelForge-Admin-Token": ADMIN_TOKEN}).status_code == 405
+    finally:
+        client.close()
+        app.dependency_overrides.clear()